An internal web application must call S3 APIs in a specific AWS account and the company wants to authenticate using its existing OpenID Connect IdP (auth.company.com). The IdP supports only OIDC. Which combination of steps will securely enable the web application to access S3? (Choose three.)

To securely access AWS S3 using an OIDC IdP, you first need to establish trust between AWS and your IdP. This is done by creating an IAM OIDC identity provider in AWS, configuring it with your IdP's URL, audience, and signing keys. Next, create an IAM role with permissions for the necessary S3 actions. The crucial part is setting the role's trust policy to allow your OIDC IdP to assume this role. The auth.company.com:aud context key is used here to match the audience claim from your IdP's token, ensuring only authenticated requests from your specific IdP can assume the role. Finally, the web application must call AssumeRoleWithWebIdentity to exchange the OIDC token for temporary AWS credentials, which it then uses to make authenticated S3 API calls. Incorrect options: IAM Identity Center is for managing user access to AWS accounts and applications, not for programmatic access from an application using an OIDC IdP. The sts.amazon.com:aud context key is incorrect; it should be the IdP's URL (auth.company.com:aud) to match the OIDC token's audience claim. GetFederationToken is used for federating users with an existing identity system, typically for long-term credentials or custom federation, not for OIDC-based application access.